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ABSTRACT 


A  one-step  r- fault  diagnosable  system  is  a  system  in  which  ail  faults  may 
be  identified  from  the  test  results,  provided  that  the  number  of  faults  does  not 
exceed  r.  In  this  paper  we  present  two  algorithms  that  may  be  used  for  the 
one-step  diagnosability  of  the  system  level  fault  model  proposed  by  Barsi, 
Grandoni  and  Maestrinlj  The  first  algorithm  may  be  used  when  the  system  is 
one-step  r-fault  diagnosable  and  no  two  units  test  each  other,  and  the  second 
algorithm  may  be  tsed  whenever  the  system  is  one-step  r-fault  diagnosable. 
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1.  INTRODUCTION 

In  the  pest  few  years,  e  greet  deal  of  effort  has  been  devoted  to  the  presen¬ 
tation  end  analysis  of  system  fault  models.  These  models  are  characterized  by 
the  fact  that  they  do  not  emphasize  test  generation,  bit  rather  emphasize  the 
use  of  test  results  for  the  purpose  of  fault  location  and  fault  detection.  The 
problems  associated  with  system  level  fault  models  are  (i)  presentation  and 
description  of  the  fault  models  themselves;  (ii)  analysis  of  the  dkgnosability 
properties  of  the  fault  model  under  various  assumptions  concerning  the  fault- 
test  relationships  and  the  system  testing  interconnection  network;  and  (iii)  syn¬ 
thesis  of  diagnosis  algorithms  for  fault  detection,  one-step  diagnosis  and 
sequential  diagnosis. 

Many  fault  models  presently  exist  [2],  17],  [8],  [9],  [14],  and  their  diagno- 
sability  properties  are  essentially  well  understood  [4],  [5],  [15-17].  The  state  of 
the  art,  as  far  as  one-step  diagnosis  algorithms  are  concerned,  is  less  satisfac¬ 
tory.  The  two  most  widely  analyzed  system  level  fault  models  are  the  PMC 
model,  proposed  by  Preparata,  Metre  and  Chien  [  14],  and  the  BGM  model  pro¬ 
posed  by  Barsi,  Grandoni  and  Maestrini  [2].  There  exist  algorithms  for  the 
one-step  diagnosis  of  the  PMC  model;  unfortunately,  they  suffer  from  some 
serious  drawbacks.  The  algorithms  proposed  fay  the  author  and  Masson  [10], 
[12]  are  only  applicable  to  regular  testing  interconnection  networks,  and  the 
ones  proposed  by  the  author  [11],  [13]  have  been  shown  to  work  only  when 
the  first  Hakimi-Amin  hypothesis  [5,  Theorem  l]  is  satisfied  and  the  number  of 
faults  is  limited.  The  algorithm  proposed  by  Corluhan  and  Hakimi  [3]  depends 
on  an  unproved  conjecture.  The  algorithms  proposed  by  Allan,  Kameda  and 
Toida  [1],  [6]  involve  tree  searching  and  backtracking. 
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The  situation  for  the  one-step  diagnosis  of  the  BGM  model  is  even  less 
satisfactory,  no  algorithm  has  been  proposed  to  date.  To  remedy  this  situation, 
this  paper  presents  two  algorithms  for  the  one-step  diagnosis  of  the  BGM 
model.  The  first  identifies  the  set  of  faulty  devices,  provided  that  the  first 
Hakim i- Amin  condition  is  satisfied  and  the  set  of  faulty  modules  is  no  greater 
than  r,  where  r  is  the  minimum  number  of  system  units  that  test  each  system 
unit  The  second  identifies  the  set  of  faulty  modules  whenever  the  system  is 
one-step  fault  diagnosable.  These  two  algorithms  are  easy  to  implement  and 
their  very  existence  is  an  a  posteriori  Indication  of  the  strength  of  the  assump¬ 
tions  of  the  BGM  model. 

In  the  first  pan  of  the  paper,  the  BGM  model  is  described.  Then  the  basic 
tenet  of  our  approach,  Le.,  the  partition  of  the  system  units  into  four  subsets  is 
presented,  together  with  the  properties  of  that  partition.  The  first  algorithm 
makes  direct  use  of  the  basic  panition  properties,  and  its  decoding  properties 
are  exhibited.  Finally  we  perform  an  analysis  of  the  failure  mode  of  the  first 
algorithm  and  present  a  remedy  -  the  second  algorithm.  We  then  show  that 
this  algorithm  may  be  used  to  decode  syndromes  for  the  BGM  model,  provided 
that  the  model  is  one-step  r- fault  diagnosable,  and  that  the  number  of  faulty 
modules  is  no  greater  than  r. 

2.  THE  BGM  SYSTEM  LEVEL  FAULT  MODEL 

The  BGM  model  proposed  by  Barsi,  Grandoni  and  Maestrini  [2]  is  a  sys¬ 
tem  level  fault  model  closely  related  to  the  PMC  model  proposed  by  Prepara  ta. 
Metre  and  Chksn  [14].  In  the  BGM  model,  a  system  S  consists  of  n  modules 
UqjU i,  ... ,  Un~\  and  a  testing  interconnection  design  7TD,  where 


U*»  W: 
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TID  —  {  ( ij )  |  U,  tests  Uj). 

It  is  that  no  module  tests  itself,  Le.,  the  diagonal  does  not  belong  to 

TID.  A  module  is  assumed  to  be  either  faulty  or  nonfaulty,  and  the  state  of 
each  module  in  5  is  assumed  to  be  constant  during  the  application  of  the  testing 
procedures.  If  (ij)  is  in  TID,  then  U,  tests  Uj,  and  the  test  outcome  au  is 
assumed  to  be  either  V  (Uj  passes  the  test)  or  "1"  W }  fails  the  test).  The  set 
of  test  outcomes  { a,j  |  Oj)  €  TID  }  is  the  syndtome  of  the  system.  In  the 
BGM  model,  the  following  relationships  between  fault  and  test  outcomes  are 
assumed: 

(i)  if  Oj)  is  in  TID  and  Ut  and  (Jj  are  nonfaulty,  then  atJ  —  O, 

(ii)  if  Oj)  is  in  TID ,  t/(  is  nonfaulty  and  Uj  is  faulty,  then  atJ  —  1; 

(ill)  if  Oj)  is  in  TID  and  both  U )  and  Uj  are  faulty,  then  afJ  —  1; 

(iv)  if  Oj)  is  in  TID,  U,  is  faulty  and  Uj  is  nonfaulty,  then  atJ  may  take  either 
the  value  0  or  1. 

Thus,  the  main  difference  between  the  PMC  model  and  the  BGM  model  is  that 
if  a  module  (J,  is  tested  by  a  module  UJy  and  if  aj.i  —  0,  then  the  module  U,  is 
nonfaulty. 

A  Ault  situation  of  the  system  S  is  described  by  the  set  Fs  of  the  faulty 
modules  in  5.  A  set  of  possible  syndromes  corresponds  to  each  Ault  situation. 
Given  a  Ault  situation,  the  computation  of  the  corresponding  syndromes  is  not 
difficult,  but  to  compute  the  Ault  situations  that  are  consistent  with  a  given 
syndrome  is  not  as  easy.  In  this  paper,  we  address  the  latter  problem  - 
namely,  syndrome  decoding  -  and  we  restrict  ourselves  to  one-step  r- fault 
diagmnbility  in  the  sense  of  Prepanta,  Metre  and  Chien  [14]. 

Definition  1 :  A  system  S  is  one-step  r-Ault  diagnosabte  if  all  faulty  modules 
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within  the  system  cut  be  identified  without  replacement,  provided  that  the 
number  of  faulty  modules  does  not  exceed  r. 

In  the  remainder  of  this  work,  5  will  be  the  index  set  that  contains  the 
indices  of  all  the  modules  in  S,  Le., 

s  —  (0,1,2,  •  •  •  ,  a— 1}; 

fs  will  be  the  index  ret  that  contains  the  indices  of  all  the  faulty  modules  in  S, 
Le., 

/s-{/€s|tf,  €FS}; 

and  given  an  index  set  a,  le  I  will  be  used  to  denote  the  number  of  elements 
inn. 

3.  IMPERFECT  ONE-STEP  DIAGNOSIS 

Our  approach  to  system  diagnosis  consists  in  partitioning  the  ret  s  into  four 
subsets  (v,  hi,  h2  and  A3)  that  are  easy  to  compute,  and  then  to  relate  those 
four  subsets  to  the  ret  fs  which  contains  the  indices  of  all  the  faulty  modules  in 
£ 

The  index  set  v  contains  the  indices  of  all  the  modules  inS  that  are  tested 
by  at  least  one  other  module  in  S  and  found  to  be  nonfaulty  by  that  module, 
Le., 

v  —  { /  €  a  |  J  in  s  exists  so  that  {J,l )  €  TID  and  a ^  —  0 }.  (1) 

Thus,  if  S  is  a  BGM  model,  Le.,  a  fault  model  that  satisfies  the  assumption  of 
section  2,  the  module  U,  is  nonfaulty  whenever  the  index  /  is  in  v. 

The  index  set  Aj  contains  the  indices  of  all  the  modules  in  5  that  are 
tested  fay  at  least  one  module  UpJ\xiv  and  found  faulty,  and  the  indices  of  all 
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the  modules  in  S  that  test  at  least  one  module  Upjinv,  and  find  it  faulty,  Le^ 

hi  —  {/  €  3  |  J  in  v  exists  so  that  ( J,l )  €  TID  and  a i#  —  1  } 

U  {/  €  s  |  J  in  v  exists  so  that  0 J)  €  TID  and  a,j  —  1 }.  (2) 

One  should  note  that  if  S  is  a  BGM  model,  then  the  index  sets  v  and  h\ 
are  disjoint,  and  U,  is  faulty  whenever  the  index  /  is  in  h2. 

The  index  set  h2  depends  on  the  cardinality  of  the  sets  £(/),  where,  for 
every  index  /  in  s  —  (v  U  h|),  the  sets  Lit )  are  defined  by 

£(/)-{>  €  a  -(v  U  hi)  |  (IJ)  €  77D  and atJ  - 1  } 

U  [J  €s  -(v  U  /»,)  1  0.0  6  77D  and a}J  -  1  }. 

Given  an  index  /,  it  is  possible  that  an  index  J  exists  so  that  the  pairs  Oj)  and 
0.0  are  both  in77D,  and  a,j  —  aju  —  1.  Obviously,  in  such  a  case  the  index  J 
appears  in  £(/ )  only  once.  The  set  Lit)  contains  the  indices  of  all  the  modules 
adfecent  to  the  module  U,  that  must  he  faulty  if  the  module  U,  is  actually  non- 
faulty.  Given  a  scalar  r,  the  set  h2  consists  of  all  the  indices  in  s,  but  not  in  v 
U  hx  such  that  the  cardinality  of  L(0  is  strictly  greater  than  r,  Le., 

h2-{/ €  a-(v  U  A,)  |  lL(Ol  >t  +  1  }.  (3) 

It  is  dear  that  if  S  is  a  BGM  model  and  if  at  most  t  modules  in  5  are  faulty, 
then  Ui  is  faulty  whenever  /  is  in  h2. 

The  index  set  h3  contains  the  indices  of  the  remaining  modules  in  S,  to., 

h3-s  -(v  UA]U  h2). 

In  this  section  we  will  examine  the  properties  of  the  sets  hJf  h2  and  h3 
when  every  module  is  tested  by  at  least  r  other  modules.  We  will  then  use 
those  properties  to  synthesize  a  decoding  algorithm  that  produces  an  index  set 
fA  containing  the  indices  of  all  the  faulty  modules  and  some  nonfaulty  ones. 


i 

i 
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provided  that  the  number  of  faulty  modules  1/s  I  is  at  most  r.  We  shall 
assume  that  the  following  assumption  holds. 

Hypothesis  1:  Every  module  in  5  is  tested  by  at  least  r  other  modules  in  S. 

The  next  lemma  is  a  direct  consequence  of  the  properties  of  the  BGM 
model  and  is  given  without  proof. 

Lemma  1:  If  S  is  a  BGM  model,  if  Hypothesis  1  is  satisfied  and  if 
I/s  I  <  t,  then  the  index  sets  h2,  h2,  hi  and/s  satisfy 

*1  U  h2  C  fs  C  h2  U  h2  u  hy 

Lemma  2:  If  5  is  a  BGM  model,  if  Hypothesis  1  is  satisfied  and  if 
I/s  I  <  r  —  1,  then  |/»i  0  <  r  —  1,  h2  -  *,  h3  -  and 

fs-h  i. 

Proof:  Let  U,  be  a  nonfaulty  module.  By  assumption,  every  module  is  tested 
by  at  least  r- other  modules  and  the  fact  that  I/s  I  <  t  —  1  implies  that  Ut  is 
tested  by  at  least  one  nonfaulty  module,  say  Uj.  Thus,  if  U,  is  nonfaulty,  an 
index  ,/exists  so  that  0./)  »  in  TID  and  a}i  —  0,  and  it  follows  that  v  contains 
the  indices  of  all  the  nonfaulty  modules  in  S. 

Now  let  Uj  be  a  faulty  module.  Hypothesis  1  and  the  fact  that  I/s  8  <  t  —  1 
imply  that  U,  is  tested  by  at  least  one  nonfaulty  module,  say  U t.  Thus,  if  U,  is 
faulty,  an  index  J  in  v  exists  so  that  0.0  is  isiTID and  aJti  —  1,  and  it  follows 
that  hj  contains  the  indices  of  til  the  faulty  modules  in  &  Clearly,  v  and  hi 
form  a  partition  for  s,  and  we  may  conclude  that  h2  and  hi  are  empty.  □ 

Lemma  3:  If  S  is  a  BGM  model,  if  Hypothesis  1  is  satisfied  and  if 
1*1  UA]U  A3I  <  r,  then 

/s-A,  UhjUhj. 
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Proof:  If  |h2  UA2UA3|<t,  then  either  \fs  I  <  r  —  1  or  —  r.  If 
1/^1  <  r  —  1,  then  Lemma  2  implies  that/5  —  hi  U  h2  U  ft3. 

If  I/s  I  —  t,  the  fact  that/5  Q  hi  U  ft2  U  h3  implies  immediately  that/; 
must  be  equal  to  hi  U  h2  U  h*  □ 

Lemma  4:  If  5  is  a  BGM  model,  if  Hypothesis  1  is  satisfied,  if  I/5I  <  r,  and  If 
I  hi  U  h2l  —  r,  then 

fs  «  h\  U  h2. 

Proof  If  I/s  I  <  r  and  if  Rhi  U  h2 1  —  r,  then  Lemma  1  implies  immediately 
that  fs  must  be  equal  to  hi  U  h2.  □ 

We  will  now  show  that  if  B/s  II  —  r  and  Ihj  U  h2l  <  r  —  1,  the  number 
of  nonfaulty  modules  in  h3  is  at  most  r. 

Lemma  5:  If  S  is  a  BGM  model,  if  Hypothesis  1  is  satisfied,  if  I/5  8  —  r,  and  if 
Ihj  U  h2I  <  r  —  1,  then  h3  contains  the  indices  of  at  most  t  nonfaulty 
modules  and 

Rh!  Uh2U  ft3|  <  2r. 

Proof  If  an  index  /  in  h3  corresponds  to  a  nonfaulty  module  U,,  then  U,  is 
tested  only  by  faulty  modules.  By  assumption.  I/s  I  —  t  and 
|h2  U  h2l  <  r  —  1  and  therefore,  the  index  J  of  at  least  one  faulty  module  is 
in  ft  3.  The  module  Uj  cannot  test  more  than  r  other  modules  in  ft3  (otherwise 
J  would  be  in  hi  U  h2),  and  it  follows  that  the  number  of  nonfaulty  modules  in 
ft3  is  at  most  r.  The  index  set  ftj  U  ft2  U  h3  contains  the  indices  of  ail  the 
faulty  modules  and  since  h3  contains  at  most  r  nonfaulty  modules, 

Ihi  UhjU  h3l  <  2r.  □ 
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Lemmas  3  and  4  suggest  the  following  decoding  algorithm. 

Algorithm  1: 

Step  Ot  Compute  the  set  v  as  in  Equation  (1 ). 

Step  1:  If  Is  —  v  I  <  r,  let  fA  —  s  —  v  and  stop;  otherwise,  go  to  Step  2. 

Step  2:  Compute  the  sets  h2  and  h1&s  'm  Equations  (2)  and  (3). 

Step  3:  If  I  hi  U  h2 1  —  t,  let/i  —  h2  U  h2  and  stop;  otherwise,  go  to  Step  4. 
Step  4:  Let/*  —  s  —  v  and  stop. 

The  properties  of  Algorithm  1  are  easily  obtained  from  Lemmas  3,  4  and 
5,  and  axe  summarized  below. 

Theorem  I:  Let  S  be  a  BGM  model,  let  Hypothesis  1  be  satisfied,  let  11/$  If  <  r, 
and  let  fA  be  the  set  generated  by  Algorithm  1.  If  tfA  !  <  r,  then  fs  —  fA, 
and  if  \fA  I  >  r  + 1,  then  l/sl  -  rtfs  C  fA,  and  \fA  — /SB  ^  t. 

In  1974,  Hakimi  and  Amin  [5]  proposed  two  characterizations  of  the  test¬ 
ing  interconnection  design  that  insure  one-step  r- fault  diagnosability  for  the 
PMC  model.  We  will  now  examine  the  implications  of  the  first  of  these 
assumptions  on  the  sets  hjt  h2,  h3  and  Algorithm  1.  We  begin  our  investiga¬ 
tion  by  repeating  the  first  Hakimi-Amin  assumption. 

Hypothesis  2:  No  two  modules  in  5  test  each  other. 

Lemma  6:  If  5  is  a  BGM  model,  if  Hypotheses  1  and  2  axe  satisfied,  and  if  11/$  II 
<  r,  then  either  Is  —  v  I<  r  —  1  or  ih2  U  h2i  —  r. 

Proof  If  I/s  I  <  r  —  1,  then  Lemma  2  implies  that/s  —  s  —  v,  and  therefore, 
Is—v|  <  T  — 1. 

If  l/s  I  —  r,  then  h3  is  either  empty  or  not.  If  h3  is  empty,  then 

fs  —  h\  U  h2  and  IAj  U/»2I  —  r.  If  h3  is  nonempty,  then  let  i  be  in  h3 .  The 

fact  that  no  two  modules  test  each  other  implies  that  no  module  in  h3  may  rest 
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any  other  module  in  hy  It  follows  that  U,  is  tested  by  exactly  r  other  modules 
that  mist  be  in  k\  U  h2,  and  we  may  condude  that  I  hi  U  h2\  must  be  equal 
to  r.  O 

The  result  of  Lemma  6  shows  that  Algorithm  1  generates  the  set  of  faulty 
modules  in  5  Whenever  Hypotheses  1  and  2  are  satisfied  and  the  number  of 
faulty  modules  is  no  greater  than  r. 

Theorem  2:  Let  S  be  a  BGM  model,  and  let  Hypotheses  1  and  2  be  satisfied.  If 
I/s  I  <  T»  then  Algorithm  1  stops  either  in  Step  1  or  Step  3  and  the  set  fA  that 
it  generates  satisfies 

fs  ~fA‘ 

It  is  clear  from  Theorem  2  that  if  S  is  a  BGM  model  and  if  Hypotheses  1  and  2 
are  satisfied,  then  S  is  one-step  r-fault  dkgnosable. 

4.  ONE-STEP  DIAGNOSIS 

At  this  stage,  we  have  a  decoding  algorithm.  Algorithm  1,  that  produces  an 
index  set  fA  that  is  equal  to  fs  whenever  \fA  R  <  r,  and  that  contains  the 
index  of  some  nonfaulty  modules  whenever  \fA\  >  r  +  1.  If,  in  addition  to 
Hypothesis  1,  we  assume  that  either  I/s  I  <  r  —  1  or  that  the  first  Hakimi- 
Amin  hypothesis  is  satisfied  and  |/s  I  <  r,  then  fA  —  fs.  In  this  section,  we 
will  modify  Algorithm  1  so  that  it  produces  the  set  of  indices  of  all  the  faulty 
modules  when  |/s  I  <  r  and  the  appropriate  assumptions  on  TIDtre  verified. 

When  Hypothesis  1  is  satisfied  and  l/sl  <  r,  Algorithm  1  fails  to  pro¬ 
duce  a  set/4  that  is  equal  to/s  I/s  I  “  T  ™d  I*]  UA2I  <  r  —  1.  The 
anhf  index  set  that  presents  a  problem  in  that  case  is  the  set  hy  It  is  dear  that 
if  the  index  /  is  in  h3>  the  module  U,  is  tested  by  exactly  r  other  modules 
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(otherwise  /  would  be  in  v  U  *1  U  h2).  Thus,  since  |/k-|  U  h2l  <  r  —  1,  at 
least  one  index  J(i )  in  *3  exists  so  that  the  module  U ,(,>  tests  the  module  Ut. 
The  fact  that  the  index  jU  )  is  also  in  #13  indies  immediately  that  the  modules 
Uj{i)  and  Ut  test  each  other.  We  are  led  to  define  the  following  index  set  x> 
that  depends  only  on  the  interconnection  design. 

Definition  2:  Let  w  be  the  subset  of  s  that  contains  all  the  indices  /  in  s  such 
that: 

(i)  the  module  U,  is  tested  by  exactly  r  other  modules,  and 

(ii)  an  index  JO)  ins  exists  such  that  U^,)  is  tested  by  exactly  r  other  modules 
in  S,  and  U-,  and  U ^  test  each  other. 

In  view  of  this  discussion,  we  arrive  at  the  result  below. 

Lemma  7:  If  S  is  a  BGM  model,  if  Hypothesis  1  is  satisfied,  if  8/s  8  —  t  and  if 
1*1  U  *2|  <  r  —  1,  then 

*3C  w. 

The  set  w  given  in  Definition  2  may  contain  indices  that  correspond  to 
nonfaulty  modules.  We  must  now  define  a  subset  x  of  w  that  possesses  the 
desired  property:  a  module  U,  is  faulty  whenever  /  is  in  *3  n  x 

Definition  3:  Let  x  be  the  set  of  all  indices  l  in  s  such  than 

(i)  U,  is  tested  by  exactly  r  other  modules; 

(ii)  an  index  jO  )  exists  such  that  is  tested  by  exactly  r  modules  in  s  and 
U,  and  UjQ)  test  each  other,  and 

(iii)  an  index  kO)  ins  exists  such  that  the  module Uk(,)  tests  U hd  but  wx  U,, 
and  (/*(/>  is  tested  by  at  least  one  module  that  does  not  test  U,. 

The  set  x  given  in  Definition  3  depends  only  on  the  testing  interconnection 
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design;  it  may  be  computed  once  and  stored.  Its  importance  lies  in  that  it  may 
be  used  directly  to  find  faulty  modules  in  hy 

Lemma  8:  Let  S  be  a  BGM  model,  let  Hypothesis  1  be  satisfied,  let 

I  —  r  and  let  l/tx  U  h2 1  <  r  —  1.  If  the  index  /  is  in  A3  n  x,  then  /  is  In 

/s- 

Proof:  Let  /  be  in  A3  n  xand  let  JU)  and  *(/)  be  indices  that  satisfy  the 
assumptions  of  Definition  3.  Suppose  that  U,  and  £/*(,)  are  both  nonfaulty. 

All  the  modules  that  test  U,  and  those  that  test  Uku)  are  then  faulty.  The 
module  £/;(*>  is  tested  by  at  least  one  module  that  does  not  test  U,  and  there¬ 
fore,  the  assumption  that  both  U,  and  £/*(,>  are  nonfaulty  implies  that  at  least 
r  +  1  modules  are  faulty.  This  is  impossible,  and  thus,  if  U,  is  nonfaulty,  Uku) 
must  be  faulty.  The  module  (Jk{,)  does  not  test  the  module  (7„  and  the  fact 
that  /  is  in  A3  implies  that  U,  does  not  test  Uk^y  Thus,  if  U,  is  assumed  to  be 
nonfaulty,  we  must  conclude  that  at  least  r  +  1  modules  are  faulty.  Once 
again,  this  is  impossible;  Therefore,  the  module  U,  must  be  faulty  -  Le.,  /  is  in 

fs-° 

Using  the  result  of  Lemma  8,  ire  may  modify  Algorithm  1  to  incorporate 
the  fact  that  under  the  appropriate  conditions,  the  set  A3  n  x  is  a  subset  of  fs. 

Algorithm  2: 

Step  O.  Compute  the  set  v  as  in  Equation  (I). 

Step  1:  If  Is  —  v  I  <  r,  let  fB  —  s  —  *  and  stop;  otherwise,  go  to  Step  2. 

Step  X  Compute  the  sets  A3  and  h2  «s  in  Equations  (2)  and  (3). 

Step  3:  If  I&!  U  h2l  —  r,  let/*  —  U  h2  and  stop;  otherwise,  go  to  Step  4 
Step  4c  Let/j  —  Aj  U  h2  U  (A3  n  x)  and  stop. 

At  this  point,  it  is  dear  that  when  the  appropriate  assumptions  are 
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satisfied,  Algorithm  2  generates  a  set  fB  that  is  a  lower  bound  for  fs. 

Lemma  9:  If  5  is  a  BGM  model,  if  Hypothesis  1  is  satisfied  and  if 
I/s  I  <  r,  then  the  scifB  generated  fay  Algorithm  2  satisfies 

/b  C/s. 

In  their  1976  paper,  Barsi,  Giandoni  and  Maestrini  [2]  proposed  a  condi¬ 
tion  on  TID  that  insures  one- step  r- fault  diagnosability.  Using  our  notation,  we 
will  now  repeat  that  assumption  and  show  that  it  may  be  used  to  insure  that  fs 
is  found. 

Hypothesis  3:  If  the  indices  /  and  J  are  in  wand  if  Ut  and  Uj  test  each  other, 
then  ice  J  at  both  are  in  x 

Lemma  10:  If  S  is  a  BGM  model,  if  Hypotheses  l  and  3  are  satisfied,  if 
Vfs  I  ■■  r  and  if  lAj  U  h2 1  <  r  —  1,  then 

lh3  Cl  x  I  —  r  —  l/ij  U  h2 1. 

Proof  The  set  h3  contains  at  least  r  —  Iftj  U  h2\  indices  and  therefore,  if  all 
the  indins  in  h3  are  also  in  x,  then 

lh3  n  xl  >  r—  l/ii  U  h2l 

If  at  least  one  index,  say  /,  is  in  h3  but  not  in  x,  then  Ut  is  tested  fay  at  least 
r  —  l/ij  U  A2I  other  modules  with  indices  in  h3.  All  the  modules  with 
in  h3  that  test  Ut  are  also  tested  by  U{.  Hypothesis  3  implies  that  they  are  all  in 
xand  therefore, 

l*3  n  xl  >  r—  Ia2  u  a2I. 


Lemma  9  implies  that  all  indices  in  h\  U  h2  U  (A3  O  x)  are  in/s,  and  using 
the  assumption  that  I/s  I  <  r,  we  obtain 
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Ia3  nxl-r  -  1/1}  u  a2I.  □ 

The  results  of  Lemmas  3,  4  and  10  show  that,  when  the  appropriate  condi¬ 
tions  are  satisfied.  Algorithm  2  generates  the  set  of  indices  of  all  the  faulty 
modules  in  S L 

Lemma  11:  If  5  is  a  BGM  model,  if  Hypotheses  1  and  3  are  satisfied  and  if  |/s| 
<  r,  then  the  index  set  fB  produced  by  Algorithm  2  satisfies 

fs  ~/b- 

Note  that  Lemma  11  implies  that  if  S  is  a  BGM  model  that  satisfies 
Hypotheses  1  and  3,  then  S  is  one-step  r-fault  diagnosabie,  Le.,  the  the  result 
given  in  (2,  Theorem  2,  p.  585]  is  retrieved. 

It  is  known  that  if  a  BGM  model  is  one-step  r-fault  diagnosabie,  then 
Hypotheses  1  and  3  are  satisfied  [2].  Hence,  we  obtain  the  main  result  of  the 
paper. 

Theorem  3:  Let  S  be  a  one-step  r-fault  diagnosabie  BGM  fault  model  and  let  Fs 
be  the  set  of  faulty  modules  in  S.  If  I/5I  <  r,  then  the  index  set  fB  gen¬ 
erated  by  Algorithm  2  satisfies 

*8~iUt\i  €/*)• 
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